{"action":"opened","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/3074","repository_url":"https://api.github.com/repos/hashicorp/vault","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/3074/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/3074/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/3074/events","html_url":"https://github.com/hashicorp/vault/issues/3074","id":246198881,"number":3074,"title":"transit: Document that sign ignores algorithms if key is ed25519","user":{"login":"kevinburke","id":234019,"avatar_url":"https://avatars1.githubusercontent.com/u/234019?v=4","gravatar_id":"","url":"https://api.github.com/users/kevinburke","html_url":"https://github.com/kevinburke","followers_url":"https://api.github.com/users/kevinburke/followers","following_url":"https://api.github.com/users/kevinburke/following{/other_user}","gists_url":"https://api.github.com/users/kevinburke/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinburke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinburke/subscriptions","organizations_url":"https://api.github.com/users/kevinburke/orgs","repos_url":"https://api.github.com/users/kevinburke/repos","events_url":"https://api.github.com/users/kevinburke/events{/privacy}","received_events_url":"https://api.github.com/users/kevinburke/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-27T23:35:45Z","updated_at":"2017-07-27T23:35:45Z","closed_at":null,"body":"If I am reading the code correctly, if I make a POST request to sign some data, and the key is of type ed25519, we'll eventually call ed25519.Sign with the private key. However, the documentation seems to imply that only the given hash algorithms are supported: https://www.vaultproject.io/api/secret/transit/index.html#sign-data\r\n\r\n```\r\nThis endpoint returns the cryptographic signature of the given data using the named key and the specified hash algorithm. The key must be of a type that supports signing.\r\n\r\nalgorithm (string: \"sha2-256\") – Specifies the hash algorithm to use. This can also be specified as part of the URL. Currently-supported algorithms are:\r\n\r\nsha2-224\r\nsha2-256\r\nsha2-384\r\nsha2-512\r\n```\r\n\r\nThis left me very confused about the actual data that got signed, and how Hashicorp was signing it, and whether it was trying to do something like sign the input with the private key, then hash it with sha512, or the reverse, or use the private key as the input to hmac.New(sha512.New, key) and skip ed25519 altogether. I had to read through the code to figure out what was going on (I think I have summarized it accurately above).\r\n\r\nIt would be good if the documentation was clearer about what Vault sign does in this case."}}
{"actor":{"display_login":"kevinburke"}}